Aggregator

A vulnerability identified as problematic has been detected in cbutlerjr WP-Members Membership Plugin up to 3.5.6 on WordPress. Impacted is an unknown function. The manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-84960. The attack can be initiated remotely. There is not any exploit available.

A vulnerability categorized as problematic has been discovered in fernandot Vigilant Plugin up to 2.10.2 on WordPress. This issue affects some unknown processing. Executing a manipulation can lead to cross site scripting. This vulnerability is registered as CVE-2026-81754. It is possible to launch the attack remotely. No exploit is available.

A vulnerability was found in boldthemes Bold Timeline Lite Plugin up to 1.2.8 on WordPress. It has been rated as problematic. This vulnerability affects the function bold_timeline_item of the component Shortcode Handler. Performing a manipulation of the argument supertitle/subtitle results in cross site scripting. This vulnerability is cataloged as CVE-2026-7438. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability was found in Premio Floating Chat Widget Contact Chat Icons Telegram Chat Line Messenger WeChat Email SMS Call Button Plugin up to 3.5.9 on WordPress. It has been declared as problematic. This affects an unknown part. Such manipulation of the argument s leads to cross site scripting. This vulnerability is listed as CVE-2026-18964. The attack may be performed from remote. There is no available exploit.

热衷于造概念、做营销、炒培训，那么 FDE 只会是又一轮行业泡沫。

A vulnerability was found in opajaap WP Photo Album Plus Plugin up to 9.2.08.003 on WordPress. It has been classified as problematic. Affected by this issue is the function getshortcodedrenderedfenodelay of the component wp_ajax_nopriv_wppa Endpoint. This manipulation of the argument HTTP_X_FORWARDED_FOR causes cross site scripting. This vulnerability is tracked as CVE-2026-18579. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability was found in specialk Simple Ajax Chat Plugin up to 20260811 on WordPress and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation results in cross site scripting. This vulnerability is identified as CVE-2026-81825. The attack can be executed remotely. There is not any exploit available.

A vulnerability has been found in themifyme Themify Plugin up to 1.5.5 on WordPress and classified as problematic. Affected is an unknown function. The manipulation leads to cross site scripting. This vulnerability is referenced as CVE-2026-78172. Remote exploitation of the attack is possible. No exploit is available.

A vulnerability, which was classified as problematic, was found in UniteCMS Unlimited Elements for Elementor Plugin up to 2.0.16 on WordPress. This impacts the function show_preview. Executing a manipulation of the argument data[name] can lead to cross site scripting. The identification of this vulnerability is CVE-2026-77150. The attack may be launched remotely. There is no exploit available.

A vulnerability, which was classified as problematic, has been found in realmag777 HUSKY – Products Filter Professional for WooCommerce Plugin up to 1.4.3 on WordPress. This affects the function wp_load_js. Performing a manipulation results in cross site scripting. This vulnerability was named CVE-2026-18562. The attack may be initiated remotely. There is no available exploit.

A vulnerability classified as problematic was found in UsersWP Plugin up to 1.2.70 on WordPress. The impacted element is the function upload_file_remove of the component AJAX Handler. Such manipulation of the argument File leads to path traversal. This vulnerability is uniquely identified as CVE-2026-19991. The attack can be launched remotely. No exploit exists.

Canonical shipped Ubuntu 24.04.5 LTS, bundling security updates and fixes for high-severity bugs into new installation media for the “Noble Numbat” release. Anyone installing fresh now gets those corrections baked in from the start, cutting the batch of updates that would normally follow setup. The point release covers more than the desktop and server editions. Nine other flavors, including Kubuntu, Xubuntu, Ubuntu MATE, Ubuntu Studio, and Edubuntu, also moved to version 24.04.5, each carrying its … More →

The post Ubuntu 24.04.5 LTS release patches security bugs across ten flavors appeared first on Help Net Security.

A vulnerability classified as critical has been found in gingerplugins Sticky Chat Widget Plugin up to 1.4.2 on WordPress. The affected element is the function save_form_data. This manipulation of the argument scw_form_fields causes sql injection. This vulnerability is handled as CVE-2026-15462. The attack can be initiated remotely. There is not any exploit available.

A vulnerability described as problematic has been identified in Booktics Plugin up to 1.0.23 on WordPress. Impacted is the function create_order_permission of the file /wp-json/booktics/v1/orders of the component Permission Callback. The manipulation results in improper privilege management. This vulnerability is known as CVE-2026-11446. It is possible to launch the attack remotely. No exploit is available.

A vulnerability marked as critical has been reported in UniteCMS Unlimited Elements for Elementor Plugin up to 2.0.16 on WordPress. This issue affects the function getWhereString. The manipulation of the argument addontype leads to sql injection. This vulnerability is traded as CVE-2026-18561. It is possible to initiate the attack remotely. There is no exploit available.

A vulnerability labeled as critical has been found in mulika MIPL Grouped Checkout Fields for WooCommerce Plugin up to 1.2.2 on WordPress. This vulnerability affects the function mipl_wc_upload_file. Executing a manipulation can lead to unrestricted upload. This vulnerability appears as CVE-2026-8778. The attack may be performed from remote. There is no available exploit.

A vulnerability identified as problematic has been detected in comesio Relevanssi Plugin up to 4.28.1 on WordPress. This affects the function relevanssi_debug_array of the file lib/debug.php of the component Debug. Performing a manipulation of the argument s/post_types/orderby results in cross site scripting. This vulnerability is reported as CVE-2026-19985. The attack is possible to be carried out remotely. No exploit exists.

A vulnerability categorized as problematic has been discovered in xootix OTP Login & Register Woocommerce Plugin up to 2.7.2 on WordPress. Affected by this issue is the function login_user_with_otp of the component OTP Rate Limit. Such manipulation of the argument ip_address leads to improper restriction of excessive authentication attempts. This vulnerability is documented as CVE-2026-12215. The attack can be executed remotely. There is not any exploit available.

Here’s a look at the most interesting products from the past week, featuring releases from Akeyless, Orchid Security, Scytale, and Securin. Securin Platform helps security teams prove when attack paths are closed Securin has announced the general availability of the Securin Platform, an AI-native Preemptive Exposure Management platform designed to answer three questions security teams struggle with every day: What can attackers actually exploit? What should we fix first? And did the fix actually work? … More →

The post New infosec products of the week: September 11, 2026 appeared first on Help Net Security.

2026年9月14日至20日，国家网络安全宣传周如期而至，邀您共筑网络安全防线。